You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2023/12/20 08:38:30 UTC

[PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

ppkarwasz opened a new pull request, #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113

   Workaround a Coursier/Ivy dependency resolution bug that affects `log4j-slf4j-impl` and `log4j-mongodb3`.
   
   This bug also affects popular sites like MvnRepository (cf. [`log4j-mongodb3:2.22.0`](https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-mongodb3/2.22.0)).
   
   Closes #2065
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113#issuecomment-1864732831

   I have doubts about this fix @ppkarwasz. It is not even reported to the source AFAIK. I am also curious how can we be certain that our solution is exhaustive?
   
   Maybe dumb, but an alternative I can't stop thinking: Why don't we document the issue and its for Coursier/Ivy users?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz merged PR #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113#issuecomment-1864883848

   To test this solution I used a micro SBT project with `build.sbt` file:
   
   ```scala
   val scala3Version = "3.3.1"
   
   lazy val root = project
     .in(file("."))
     .settings(
       name := "Scala 3 Project Template",
       version := "0.1.0-SNAPSHOT",
   
       scalaVersion := scala3Version,
   
       libraryDependencies ++= Seq(
           "org.apache.logging.log4j" % "log4j-slf4j-impl" % "2.23.0-SNAPSHOT",
           "org.apache.logging.log4j" % "log4j-mongodb3" % "2.23.0-SNAPSHOT"),
       resolvers += Resolver.mavenLocal
     )
   ```
   
   With SBT 1.9.8 I can confirm that this workaround works. Of course, the issue must be reported to Coursier/Ivy. AFAIK no-one did it and I'll do it myself shortly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113#issuecomment-1865753485

   > To test this solution I used...
   
   @ppkarwasz, I wasn't questioning whether your solution fixes the user-reported problem or not. I have no doubts you did your due diligence for testing. My question is about coverage: How can we know if we covered all such Coursier/Ivy misbehaviour? Or are we just patching a single hole among many?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Workaround Coursier/Ivy dependency resolution bug (logging-log4j2)

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #2113:
URL: https://github.com/apache/logging-log4j2/pull/2113#issuecomment-1865833496

   Since there are a lot of dependency resolution libraries out there, we are probably working around one bug among many.
   My reason behind supplying this patch is that MvnRepository.com (the first search result for `log4j-slf4j-impl`) also exhibits signs of this problem (BTW: I also contacted them and asked to fix it on their website) and the workaround does not cost us anything.
   
   I found a corresponding bug in Coursier: coursier/coursier#2790


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org